The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →To reduce the risk of Microsoft 365 account takeover, require multifactor authentication (MFA) for every user, block legacy authentication, and protect administrator accounts with phishing-resistant MFA where possible. Choose either Security Defaults for a simple baseline or Conditional Access for customized policies; keep emergency access accounts outside policies that could lock out every administrator.
Check which sign-in policy is active
In the Microsoft Entra admin center, check whether Security Defaults is enabled and review any existing Conditional Access policies before changing sign-in controls. Security Defaults is available with Entra ID Free; Conditional Access requires Entra ID P1 or P2. Microsoft says the two approaches cannot be active at the same time, so do not disable Security Defaults until replacement Conditional Access policies are ready. See Microsoft’s Security Defaults documentation and Microsoft 365 MFA setup guidance.
As an Amazon Associate I earn from qualifying purchases.
| Decision | Security Defaults | Conditional Access |
|---|---|---|
| License | Available through Entra ID Free. | Requires Entra ID P1 or P2. |
| Configuration | Simple, on/off baseline without customization. | Customizable policies, scopes, and conditions. |
| Baseline protections | Includes MFA requirements and legacy authentication blocking. | When migrating, recreate the protections you need; Microsoft’s templates include MFA for users and administrators and legacy authentication blocking. |
| Best fit | Organizations that need straightforward baseline controls. | Organizations that need granular policy configuration and have eligible licensing. |
Secure administrator accounts first
Identify accounts assigned privileged roles and require MFA for them. Microsoft recommends phishing-resistant MFA for key built-in administrator roles, including Global Administrator, Application Administrator, Authentication Administrator, Billing Administrator, Cloud Application Administrator, Conditional Access Administrator, Exchange Administrator, Helpdesk Administrator, Password Administrator, Privileged Authentication Administrator, Privileged Role Administrator, Security Administrator, SharePoint Administrator, and User Administrator. Conditional Access role assignments do not enforce policies for custom roles or administrative-unit-scoped roles, so account for those separately. See Microsoft’s administrator role policy guidance.
Separate daily and administrative work
Use ordinary accounts for routine work such as email and Microsoft 365 apps, and reserve separate admin accounts for administrative tasks. Keep the number of administrator accounts low and assign each person only the roles needed for their work. Microsoft’s Microsoft 365 business admin-account guidance recommends these practices.
#1 Best Overall
- Designed for Your Windows and Apple Devices | Install premium Office apps on your Windows laptop, desktop, MacBook or iMac. Works seamlessly across your devices for home, school, or personal productivity.
- Includes Word, Excel, PowerPoint & Outlook | Get premium versions of the essential Office apps that help you work, study, create, and stay organized.
- 1 TB Secure Cloud Storage | Store and access your documents, photos, and files from your Windows, Mac or mobile devices.
- Premium Tools Across Your Devices | Your subscription lets you work across all of your Windows, Mac, iPhone, iPad, and Android devices with apps that sync instantly through the cloud.
- Easy Digital Download with Microsoft Account | Product delivered electronically for quick setup. Sign in with your Microsoft account, redeem your code, and download your apps instantly to your Windows, Mac, iPhone, iPad, and Android devices.
Use phishing-resistant MFA where possible
Passkeys and FIDO2 security keys are phishing-resistant methods; Windows Hello for Business and certificate-based authentication are also named in Microsoft’s administrator guidance. FIDO2 security keys use hardware-backed cryptographic proof. A key is an optional authenticator, not a stand-alone fix: the organization must configure and support the method, users must register it, and recovery arrangements must be considered. Microsoft’s identity-protection guidance describes passkeys and FIDO2 keys as strong protection against credential theft and sophisticated phishing.
Traditional MFA is still a useful baseline, but methods such as SMS or voice are more vulnerable to interception and social engineering than phishing-resistant options. Do not enforce a method before administrators and affected users can use it: Microsoft warns that applying a phishing-resistant policy before administrators register suitable methods can lock them out.
Roll out Conditional Access carefully
- Have affected users, especially administrators, register supported authentication methods before enforcement.
- Scope the policy to the relevant built-in directory roles and resources, and exclude designated emergency access accounts.
- Where available, start the policy in report-only mode and review its impact before turning it on.
- If your organization uses external authentication methods, note Microsoft’s compatibility limitation with authentication strengths; its guidance says to use the Require multifactor authentication grant control in that situation.
Require MFA for everyone and block protocol bypasses
Security Defaults provides a straightforward baseline: users must register for MFA; Microsoft prompts users for MFA when it determines it is needed; and, after registration, listed administrators are required to use MFA at every sign-in. Security Defaults also blocks legacy authentication, including Exchange ActiveSync basic authentication, because older protocols may not support MFA and can bypass MFA policies. Microsoft’s documentation says its MFA registration grace period was removed starting July 29, 2024. MFA is not a guarantee against account takeover: Microsoft says it can block over 99.2% of identity-based attacks, an effectiveness claim from Microsoft rather than a guarantee for an individual tenant.
Before enabling Security Defaults, inventory older clients, devices, and applications that may depend on legacy authentication or device code flow. Security Defaults blocks device code flow too, so dependent apps or devices cannot sign in under that setting. Microsoft recommends revoking existing sign-in tokens when enabling Security Defaults, prompting users to authenticate again and register for MFA. If you need granular exceptions or control over scopes, use Conditional Access instead and deliberately reproduce the baseline protections you require.
Rank #3
- FIDO2 CERTIFIED: FIDO Alliance Certified FIDO2 v2.1 and CTAP Level 1 for 2FA and MFA on Google Microsoft Apple GitHub login.gov AGOV SwissID and any WebAuthn service
- PASSKEY READY: Works as a hardware passkey for passwordless sign-in where the service enables it and as a U2F and WebAuthn security key everywhere else
- CERTIFIED SECURITY: NXP JCOP 4.5 secure element rated Common Criteria EAL6+ (augmented)
- TAP OR INSERT: Dual NFC ISO 14443 and contact ISO 7816 interface in an ID-1 format smart card that is passive and battery-free
- BUILT TO LAST: Passive smart card made in Switzerland designed by Swiss company Cryptnox and backed by a 2 year manufacturer warranty
Keep emergency access and plan for lockout
Microsoft recommends maintaining two cloud-only emergency access accounts permanently assigned the Global Administrator role. Exclude these designated accounts from Conditional Access policies that could otherwise lock out all administrators. Treat them as sensitive recovery credentials, monitor their use, and follow Microsoft’s current emergency-access recommendations for credentials and alerts. They are exceptional recovery paths, not accounts for daily work.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Add device and sign-in risk controls where appropriate
Where your licensing and deployment support it, Conditional Access can require managed or compliant devices; unmanaged devices may lack organizational controls and endpoint protection. Risk-based Conditional Access can block or require stronger authentication for risky sign-ins, with relevant Identity Protection capabilities associated with Entra ID P2. These controls complement, rather than replace, strong authentication. Microsoft’s identity infrastructure guidance discusses device and risk controls.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
